Method for assuring event record integrity

Abstract

A method for assuring event record integrity including registering at least one callback function, the callback function being associated with a first callback function identifier, receiving an event having a second callback function identifier, identifying the callback function based on matching the second callback function identifier to the first callback function identifier, and calling the identified registered callback function to validate authenticity of the event.

1. A method in a data processing system for trusted application event auditing, the method comprising:
 registering a callback function with an audit service, wherein the callback function is trusted code associated with a first callback function identifier; 
 registering an event receiver, and associating the event receiver with the callback function; 
 registering a second callback function identifier with the audit service; 
 associating the second callback function identifier with the callback function; 
 providing the second callback function identifier from a trusted application to the event receiver in response to seeking validation of the trusted application; 
 receiving an event having the second callback function identifier at the event receiver, wherein the received event comprises an event identifier; 
 calling the audit service with the second callback function identifier being included as an argument of the callback function; 
 identifying the callback function based on matching the second callback function identifier to the first callback function identifier; 
 calling the callback function to validate authenticity of the event, wherein the calling comprises calling the callback function using the event identifier; and 
 removing the second callback function identifier from registration in the audit service in response to the second callback function identifier being included as the argument of the callback function. 
 
     
     
       2. The method of  claim 1 , further comprising:
 registering an application and associating the application with the callback function. 
 
     
     
       3. The method of  claim 1 , wherein the callback function validates authenticity of the event as being from the trusted application; and
 wherein the callback function is sent from the event receiver in response to the matching of the second callback function identifier to the first callback function identifier, the callback function including the second callback function identifier as an argument. 
 
     
     
       4. The method of  claim 1 , wherein the identifying of the callback function is performed by the event receiver; and
 wherein the calling of the callback function is performed by the event receiver. 
 
     
     
       5. The method of  claim 1 , further comprising:
 failing event authentication in response to the second callback function identifier not matching the first callback function identifier. 
 
     
     
       6. A software product comprising a program of instructions stored on a machine readable storage medium for trusted application event auditing, wherein the program of instructions upon being executed in a data processing system causes the data processing system to perform activities comprising:
 registering a callback function with an audit service, wherein the callback function is trusted code associated with a first callback function identifier; 
 registering an event receiver, and associating the event receiver with the callback function; 
 registering a second callback function identifier with the audit service; 
 associating the second callback function identifier with the callback function; 
 providing the second callback function identifier from a trusted application to the event receiver in response to seeking validation of the trusted application; 
 receiving an event having the second callback function identifier at the event receiver, wherein the received event comprises an event identifier; 
 calling the audit service with the second callback function identifier being included as an argument of the callback function; 
 identifying the callback function based on matching the second callback function identifier to the first callback function identifier; 
 calling the callback function to validate authenticity of the event, wherein the calling comprises calling the callback function using the event identifier; and 
 removing the second callback function identifier from registration in the audit service in response to the second callback function identifier being included as the argument of the callback function. 
 
     
     
       7. The software product of  claim 6 , further comprising:
 registering an application and associating the application with the callback function. 
 
     
     
       8. The software product of  claim 6 , wherein the callback function validates authenticity of the event as being from the trusted application; and
 wherein the callback function is sent from the event receiver in response to the matching of the second callback function identifier to the first callback function identifier, the callback function including the second callback function identifier as an argument. 
 
     
     
       9. The software product of  claim 6 , wherein the identifying of the callback function is performed by the event receiver; and
 wherein the calling of the callback function is performed by the event receiver. 
 
     
     
       10. The software product of  claim 6 , further comprising:
 failing event authentication in response to the second callback function identifier not matching the first callback function identifier. 
 
     
     
       11. A data processing system configured for trusted application event auditing, comprising:
 a memory configured to store registration with an audit service of a callback function, wherein the callback function is trusted code associated with a first callback function identifier; 
 an event receiver configured to receive an event having a second callback function identifier, wherein the received event comprises an event identifier, wherein a second callback function identifier is registered with said audit service and is associated with the callback function; 
 means for providing the second callback function identifier from a trusted application to the event receiver in response to seeking validation of the trusted application; 
 means for calling the audit service with the second callback function identifier being included as an argument of the callback function; 
 a processor connected to said memory and configured to perform instructions for identifying the callback function based on matching the second callback function identifier to the first callback function identifier; and 
 a bus connected to said processor and said event receiver, said bus being configured to communicated a call from the event receiver calling the callback function to validate authenticity of the event, wherein the calling comprises calling the callback function using the event identifier; 
 wherein said memory further being configured to store registration of an event receiver associated with the callback function; and 
 wherein the second callback function identifier is removed from registration in the audit service in response to the second callback function identifier being included as the argument of the callback function. 
 
     
     
       12. The data processing system of  claim 11 , wherein said memory is further configured to store registration of an application associated with the callback function. 
     
     
       13. The data processing system of  claim 11 , wherein the callback function validates authenticity of the event as being from the trusted application; and
 wherein the callback function is sent from the event receiver in response to the matching of the second callback function identifier to the first callback function identifier, the callback function including the second callback function identifier as an argument. 
 
     
     
       14. The data processing system of  claim 11 , wherein the identifying of the callback function is performed by the event receiver; and
 wherein the calling of the callback function is performed by the event receiver. 
 
     
     
       15. The data processing system of  claim 11 , wherein the processor is further configured to fail event authentication in response to the second callback function identifier not matching the first callback function identifier.